By Kshitij Jain, Co-Founder, all things people (atp)
Most conversations about AI governance start from the wrong assumption: that rules are what you put in place once the excitement dies down, to stop people doing something wrong. In practice, the opposite is what I see. The enterprises where AI adoption has actually taken hold, where employees use it daily rather than in a pilot that quietly ends, are almost always the ones that wrote down the rules first.
The reason is simple. Most employees are not reckless with AI. They are nervous about it. They have read enough about data leaks and hallucinations to worry that using the tool wrongly could cost them their credibility or even their job. So they do the safest thing available, which is to use it invisibly. They paste a paragraph into a personal account on a browser tab that is not the company’s, get an answer, rewrite it slightly, and never mention it. That behaviour is now common inside organisations that believe they have low AI adoption. Adoption is not low. It is unrecorded, unreviewed, and happening on infrastructure that the company does not control.
In more than one organisation, leaders believed AI adoption was still in its early stages. A few conversations with employees revealed the opposite. People were already using AI every day—they just weren’t using enterprise-approved tools because nobody had explained where the boundaries were.
Governance is what converts that shadow usage into something the organisation can see, support and improve. At its simplest, an AI governance framework is a set of principles, policies and decision rules that tell employees how AI should—and should not—be used across the organisation. It is an adoption strategy before it is a risk strategy.
This is becoming particularly relevant in India. Enterprises are rapidly deploying Microsoft Copilot, ChatGPT, Gemini, internal AI assistants and industry-specific AI tools across Global Capability Centres, financial services, manufacturing, healthcare and technology businesses. AI is no longer confined to innovation teams; it is becoming part of everyday work, often faster than organisations are updating their policies.
What employees are actually asking
The questions that come up when you sit with functional teams are more practical than philosophical. Whether they can put a customer email into an AI tool to draft a reply. Whether the recruiter can paste twenty CVs in to get a shortlist. Whether the manager can use it to improve a performance review. Whether the finance team can upload a draft board deck to get the summary tightened.
Each of those has a defensible answer, and the answers are different for each case. The customer email is usually fine on an enterprise tool, but not on a public version of the same tool. The CV shortlist raises further questions, as a screening decision made by a model is one that the organisation has to be able to explain. The performance review is a case where AI may help improve the quality of writing, but judgement itself should remain human. The board deck depends entirely on which tool is being used and under what contract.
An employee cannot work any of this out alone, and just saying “be careful” does not really help them. What they need is simple guidance that helps them answer those questions.
What the framework has to contain
A governance framework that people actually use tends to be short and straightforward.
It needs five things.
It needs a named list of approved tools, with the enterprise account clearly identified, because telling people to use AI responsibly without telling them where and how is asking them to keep using their personal account.
Next comes a data classification that a non-technical employee can easily understand. Not a nine tiered structure. Something closer to three buckets: information that can go into an approved tool, information that cannot go into any tool, and information that requires specific approval.
Equally important is a list of decisions that a model may inform but may not make. E.g., Hiring, promotion, termination, performance ratings, credit and eligibility decisions, and anything with a legal or regulatory consequence. This is the part most frameworks skip, and it is the part that matters most.
It needs a verification standard proportionate to the risk. Not everything requires a fact check. Anything that leaves the building, reaches a customer, or informs a financial or legal position does.
Finally, it needs a named owner. If AI governance sits with IT alone, it becomes a security policy and misses the employment and fairness questions entirely. If it sits with legal alone, it becomes a restriction list that nobody reads. It works best when technology, legal, HR and business leaders co-own it, with visible leadership sponsorship.
The harder half of the problem
Everything above concerns AI that employees use. There is a second category that receives far less attention and carries just as much risk: AI applied to employees.
Organisations are increasingly using AI across recruitment, onboarding, workforce planning, employee listening, capability assessment and learning. The insight this produces is genuinely valuable. It also raises a different set of governance questions because the employee usually never learns that an inference was made about them.
Did the employee understand that a model would analyse their comments? If the model infers disengagement, flight risk or a capability gap, is that inference disclosed to them? Can they challenge it? Who inside the organisation can see it, and for how long is it retained?
The uncomfortable case is the one where an inference drawn from anonymous feedback ends up informing a decision about the person who gave it. That is the point at which employee listening starts losing credibility. It is also the point at which employees stop answering honestly, which destroys the value of the exercise entirely. Anonymity that is promised but not architecturally guaranteed is not anonymity, and employees work this out faster than organisations expect.
Governance for this category has to be built in rather than written afterwards. It means minimum reporting thresholds enforced in the product, retention limits, a documented list of decisions the analysis may not feed, and disclosure to employees in language they can actually understand rather than a hidden consent line. Organisations should expect the same standards from their technology vendors and ask how anonymity is enforced, where the data sits, what the model is trained on, and whether their data ever leaves their environment.
Why this matters in India
The Digital Personal Data Protection Act has raised the bar for anyone processing employee or customer information. Consent, purpose limitation and the obligations that come with processing personal data apply equally when personal data is processed through AI tools. An employee pasting a customer record into a consumer AI service is still processing personal data, and the organisation remains responsible whether it knew about it or not.
For CIOs and boards, this is both a governance and a technology issue. The challenge is to accelerate AI adoption while protecting enterprise data and maintaining employee trust. Focusing only on control will simply drive AI usage further into the shadows.
The frameworks that succeed are not the ones that are published once and filed away. AI is evolving too quickly for that. Governance needs an owner, a regular review cycle, and a route for employees to raise questions the policy does not yet cover or things they do not understand.
It also needs ongoing training. AI literacy is becoming a workplace skill. Employees need to know how to frame a request, how to recognise when an answer is fluent but wrong, and what to do when they cannot independently verify the output.
In Summary
The organisations that will get the most from AI are not the ones with the longest list of deployed tools. They will be the ones where an employee knows, without asking, whether the thing they are about to do is allowed. That certainty is what turns cautious, hidden, individual experimentation into productivity that the business can actually measure.
Governance is not the brake on that. It is the thing that lets you take your foot off it.
When employees know the boundaries, they stop asking whether they should use AI and start focusing on how to use it well. That is when adoption truly begins.